CVE-2024-11297: cyberlord92 page and post restriction Observable Discrepancy
Vulnerability summary
CVE-2024-11297 is a high (CVSS 7.5) Observable Discrepancy vulnerability in cyberlord92 page and post restriction. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.3.7.
Timeline
- 20-12-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.01 pp
From 0.60% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Cyberlord921 product
- page and post restriction≤ 1.3.6
Miniorange1 product
- page_restriction< 1.3.7
Wordpress1 product
- page-and-post-restriction≤ 1.3.6 (fixed in 1.3.7)
3 vendors · 3 products
References
4 links- www.wordfence.com/threat-intel/vulnerabilities/id/6d12ab8c-d5d0-4e02-986e-e894fae073e5?source=cveExploitThird Party Advisory